Ongoing Monitoring Obligations for Law Firms
Australian law firms must apply ongoing monitoring to designated service clients under the AML/CTF Act 2006. Here is what the obligation requires.
Australian law firms providing designated services must apply ongoing monitoring to each client relationship under the AML/CTF Act 2006. Ongoing monitoring means scrutinising transactions for inconsistencies with the client's known business and risk profile, keeping CDD records current, and re-screening clients against PEP and sanctions lists at a frequency set by the firm's AML/CTF programme.
What does ongoing monitoring require for law firms?
Ongoing monitoring sits in Part B of a law firm's AML/CTF programme. The obligation has three components: 1. Transaction monitoring — reviewing client instructions and fund flows for patterns inconsistent with the client's profile or matter type 2. CDD currency — ensuring identity verification and beneficial ownership information remains current, and re-collecting it when a client's circumstances change 3. PEP and sanctions re-screening — running client names against consolidated PEP and sanctions lists at the frequency defined in the programme (typically monthly for high-risk, quarterly for standard-risk)
Which clients require ongoing monitoring?
Every client receiving a designated service must be subject to ongoing monitoring. For law firms, designated services include: - Receiving, holding, or transferring money or property on behalf of a client - Assisting with the purchase or sale of real property - Creating, operating, or managing a legal arrangement such as a trust - Acting as a nominee director, shareholder, or trustee Firms must apply a risk-based approach to monitoring intensity — high-risk clients (PEPs, non-resident clients, complex trust arrangements) warrant more frequent review than a standard-risk individual seeking routine conveyancing assistance.
What triggers an out-of-cycle enhanced review?
Your AML/CTF programme should define the specific events that trigger an out-of-cycle CDD refresh or enhanced review. Common triggers include: - A PEP or sanctions screening match - A significant change in the client's transaction pattern or matter type - A change in beneficial ownership of a corporate client - Instructions involving a high-risk jurisdiction - A third-party payment instruction received at or near settlement AMLify for law firms surfaces these triggers as real-time AMLCO alerts so the firm can act before the matter proceeds.
How long must ongoing monitoring records be kept?
Records of all ongoing monitoring activities must be retained for seven years under the AML/CTF Act 2006. This includes the dates and outcomes of PEP and sanctions screens, records of transaction monitoring alerts and their disposition, and notes of any CDD refreshes during the client relationship. These records are a standard request in an AUSTRAC supervision review — firms without a documented monitoring history face difficulty demonstrating programme compliance.
Key Takeaways
- Ongoing monitoring is mandatory under Part B of the AML/CTF programme for every client receiving a designated service
- Three components: transaction monitoring, CDD currency, and PEP/sanctions re-screening at a programme-defined frequency
- Risk-based intensity — high-risk clients (PEPs, complex structures, non-resident) require more frequent monitoring than standard-risk clients
- Trigger events require out-of-cycle review — ownership changes, jurisdiction flags, and third-party payment instructions should be defined in the programme
- Seven-year retention applies to all monitoring records; AMLify for law firms logs and retains these automatically
Frequently Asked Questions
Q: Does ongoing monitoring apply to existing clients onboarded before Tranche 2?
Yes. The AML/CTF Act 2006 obligations apply from 1 July 2026 to all current and future designated service relationships. Law firms must bring existing clients into their ongoing monitoring framework — re-screening against PEP and sanctions lists, and refreshing CDD records where they are out of date. The programme should document how the firm will address its legacy client backlog.
Q: What is the minimum re-screening frequency for PEP and sanctions checks?
The AML/CTF Act 2006 does not prescribe a fixed frequency — it requires a risk-based approach. Most programmes set monthly screening for high-risk clients and quarterly for standard-risk. What matters to AUSTRAC is that the firm has documented a frequency, applies it consistently, and can produce records confirming it was followed.
Q: What must the AMLCO do when an ongoing monitoring alert fires?
When a PEP match, sanctions flag, or transaction monitoring alert is raised, the AMLCO must review it within the timeframe set by the programme and record a disposition — whether the alert is a false positive, requires enhanced due diligence, or warrants a Suspicious Matter Report. If the alert suggests money laundering or terrorism financing, an SMR must be filed with AUSTRAC within 24 hours. All decisions must be documented against the client file.
This is general information only and not a substitute for legal advice.